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Presenter: 


Topic: Steering Group update 


Peter Bloomfield 


Issue: The minutes (including draft minutes) for the following recent 
steering groups are presented for information: 
e Change Board - 21 August, 18 September and 16 October 


DCEO SG - 17 August, 21 September and 19 October 
Policy SG - 7 September and 5 October 

Operations SG - 1 September and 6 October 

Comms SG - 23 August 


The minutes will be published as an SLT paper. 
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Change Programme Board Minutes 
21 August 2017 


Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Steve Wood Deputy Commissioner (Policy) 

James Dipple-Johnstone Deputy Commissioner (Operations) 

Jo Pedder Head of Policy & Engagement 

Ken Macdonald Head of ICO Regions 

Faye Spencer Interim Head of Customer Contact 
Heather Dove Head of Finance 

Rob Parker Head of Corporate Communications 
Andrew Laing Head of Data Protection Complaints and Reviews 
Steve Eckersley Head of Enforcement 

Sarah Meyers Change Programme Manager 

Richard Marbrow Corporate Governance Group Manager 
Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Emma Deen, Jonathan Bamford, 
Anulka Clarke, Mike Collins and Rachael Cragg 


2. Matters arising from the previous meeting 
Minutes 
The minutes of the previous meeting were agreed 


Outstanding Actions 
The communications plan was completed. 


3. Monthly Report Review 
Service delivery 
Sarah Meyers updated on the report:- 
e PDB refinement of workshop material to training 
e PDB implementation project set up with project 
implementation team meeting separately from SDPB, updated 
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revised RAID and backlog created with actions prioritised for 
implementation. 

e Working on milestones for critical decisions for pilot 
implementation 


Enabler/Support: 
e [Redacted] 


Policy & Engagement: 
e In addition to the report, Jo Pedder confirmed that there is 
now a second version of the bill and there will be 3 read 
through sessions booked in for this week. 


4. PDARFs — Proposal for Policy Advice Services 
Discussion 
The proposed changes to the existing internal policy advice service 
was discussed with the objective being to focus the limited policy 
resource more effectively on the ICO’s current strategic and 
operational priorities. 


The proposal has two stages: - 
e Immediate transitional phase 
e Launch of a new rebranded service from May 2018 


Decision 

It was agreed that we need to look at reducing the demand for 
requests for advice. However, it is essential to have mechanisms in 
place to ensure that advice will be available. 


Andy Laing stated that there is an increased risk relying on the 
experience of managers and case officers as this experience has 
decreased recently which is potentially why more advice is being 
sought from policy advice. 


Actions 
Department Heads to meet to agree key messages that need to be 
communicated across the organisation. 


Post Meeting Update: 

Actions 

Richard Marbrow to add to the risk register the associated risk to 
the quality of decision making as a result of the change to the 
PDARF process 
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5. Communications 


Discussion 
Robert Parker ran through the new integrated corporate 
communications grid. 


Decision 

It was agreed that the communications grid should be taken to the 
next policy steering group meeting and Rob Parker will be in contact 
across the office for further requirements 


Actions 

Caroline Robinson to circulate the communications grid to the board 
members and to add to the agenda of the next policy and 
operations steering group. 


Robert Parker to meet with department heads to go through the 
grid. Communications to be agreed and shared with staff in 
relevant departments by next Change Board Meeting (18/9/17) 


6. Any Other Business 
[Redacted ] 


Discussion 

Sarah Meyers updated on the following areas: 

e Updated milestones on project plan 

e EUDPR network meetings held - staff were asked for themes and 
areas to work on for communications planning — will be 
discussing with Rob. 

e Internal survey launched — featured on ICON 

e Change programme project pages on front page of ICON and 
now all projects have a page with relevant project documents 
easily accessible 


7. Raid Log 


Sarah Meyers highlighted that there is a risk around further specific 
training with gaps in knowledge. This will impact on the ICO’s 
preparedness prior to May 2018 as current staff who have 
completed DPA to GDPR training will not be receiving any further 
training as the focus now was on developing new starter training. Jo 
Pedder confirmed that when guidance is launched Know abouts will 
be scheduled with it but this was the only other planned training for 
current staff. 
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Decision 
It was agreed that a review of training will be discussed at the next 
meeting. 


Change Board 18 September 
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Change Programme Board Minutes 
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Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Jonathan Bamford Head of Parliament and Government Affairs 
Jo Pedder Head of Policy & Engagement 

Mike Collins Head of Organisational Development 
Emma Deen Head of Business Development & IT 

Faye Spencer Head of Customer Contact 

Rob Parker Head of Corporate Communications 
Andrew Laing Head of Data Protection Complaints and Reviews 
Anulka Clarke Head of Assurance (Interim) 

Louise Byers Head of Risk & Governance 

Rachael Cragg Group Manager Change Programme 

Sarah Meyers Change Programme Manager 

Richard Marbrow Corporate Governance Group Manager 
Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from James Dipple-Johnstone, Steve Wood, 
Steve Eckersley, Heather Dove, Ken Macdonald and Adam 
Sowerbutts 


2. Matters arising from the previous meeting 
Minutes 
The minutes of the previous meeting were agreed. 


Action Board 
All actions were completed. 


3. Monthly Report Review 
Service Delivery: 

e Rachael Cragg highlighted that the PDP pilot is due to go live 
shortly once the new technology and people resources are in 
place. This is expected to be in early November. 

Enabler / Support 

e Michael Collins updated the board on the assessment centres 
that are currently being held. This is a new initiative with the 
first assessment centre having being held in early September. 
Feedback from this was very positive. A much greater number 
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of candidates had been seen than via more traditional 
selection processes and the assessment centre tests/exercises 
were felt to have provided a much more robust means of 
assessment than an ‘interview only’ approach. 


e The board agreed that when doing volume recruitment it is 
preferable to use the assessment centre model. However, the 
board must not lose sight of the fact that there is still a lead 
in time for the recruitment process. The end to end process to 
fill a position is still three months. Staff in HR and the 
business managers who had supported the first assessment 
centre were thanked for their commitment to and support for 
the new approach. 


e [Redacted] 


e It was also agreed to highlight the need to pay fees in the 
SME guidance on GOV.UK. 


Actions 

Louise Byers to liaise with Corporate Communications about 
communicating the need to pay fees at the end of the DCMS 
consultation. 


Policy & Engagement 
e Jo Pedder updated the board on work the ICO is involved in 
within Article 29. 


e Jonathan Bamford updated on the new Data Protection Bill 
and guidance. 
o A blog has been posted on ICON. 
o A ministerial meeting was held last week. 
o The second reading of the Bill is scheduled for 10 
October. 


e Sarah Meyers asked if there is any process in place to deal 
with any queries about the DP bill. The board agreed to keep 
an eye on the number of calls coming in and the possibility of 
putting in a process to capture the nature of these queries if 
necessary. 


4. GDPR Internal Compliance Project 
Discussion 
e The report makes the board aware of the areas that are being 
focussed on. The high priority areas identified are: 
e Contracts and 
e Human Resources records 
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e Work had begun to ensure that ICO’s contracts with its data 
processors are GDPR ready, but progress had been slow 
particularly since the recent change in focus of legal 
resources. Louise flagged the need for us to be able to 
resource this work effectively if we were to ensure contracts 
are addressed prior to May 2018. 


Paul Arnold confirmed that Emma Bate, the ICO’s new General 
Legal Counsel, was available to get directly involved in this 
work and was also the right person to contact in respect of 
identifying further legal resources. 


e Regarding our HR records, it was confirmed that the task of 
reviewing all records held by the ICO was significant and 
resources were limited. 


Paul Arnold confirmed that it was important that this work was 
resourced adequately and that the board should be appraised 
as soon as possible of any potential shortfall in resources. He 
also welcomed proposals to bridge the gap with funds to be 
made available if needed. 


e ISO27001: Louise Byers stated that this project is being very 
well managed however there is a need for other areas of the 
organisation to be involved. 


Actions 

Louise Byers to liaise with Emma Bate regarding the resourcing of 
our contracts work and to bring a resource proposal to the board if 
necessary. 


Mike Collins to liaise with Louise Byers about the resources needed 
to complete the review of our HR records and to also bring any 
resource proposal to the Change Board. 


5. Open Case Reduction Plan 
Discussion 
This paper has been brought to the Change Programme Board to be 
ratified. However, it needed to be first considered by the Service 
Delivery Project Board (SDPB). 


The board also noted that the report appears to take into 
consideration the needs of one department, but did not appear to 
consider resources available in more discretionary work areas. The 
Board also noted that the paper suggested the proposal had already 
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been implemented from early September before being brought to 
the Change Board for approval. 


Decision 

The proposal was not agreed by the board and Rachael Cragg was 
asked to take it back to the SDPB to ensure consultation with the 
full range of departments directly affected by the proposal. If, after 
taking into account matters beyond the boundaries of the 
Enforcement Department, the proposal was supported by the SDPB, 
it could return to Change Board or to SLT for final consideration. 


Actions 
Rachael Cragg to take the report to the SDPB meeting on Thursday 
to discuss the matter further. 


6. How the PDB pilot will work 
Discussion 
This paper is brought to the board for information. 


The Service Delivery Project is overseeing this work. 


7. Discussion on operational capacity and demands including 
consideration of training needs 
Discussion 
The GDPR staff survey concluded on 8 September. 55% of staff 
completed the survey. The Change Programme team will study the 
results and will be highlighting areas of concern. They will also be 
taking into account the feedback received from Network. 


Andy Laing stated that there was an action from the Operation 
Steering Group for the Operational Department Heads to complete a 
training needs analysis and take proposals to the Change 
Programme Board. 


Mike Collins indicated to the board that Learning & Development are 
reviewing the induction process. The possibility of outsourcing 
meeting training needs was also discussed. Jo Pedder stated that 
this has been looked at previously. 


Decision 

The board agreed that the action taken in relation to training needs 
in the Operations Steering Group is broader than just the 
Operational Directorate and should also cover other directorates 
within the organisation. 
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Actions 
Jo Pedder to find the previous papers covering outsourcing training 
on GDPR and bring them to the next Change Programme Board. 


Andy Laing to send Rachael Cragg the training analysis spreadsheet 
for amendment and to send it out to all departments for completion. 


Change Programme team to produce a report on the survey results 
and bring it to the next Change Programme Board meeting. 


8. Communications 
Discussion 
Robert Parker has been meeting with the Department Heads and 
reported that everything is on track. 


g. Raid Log 
Discussion 
Paul Arnold asked board members if they were comfortable with the 
relative risks and issues documented in the RAID log and whether 
any ratings needed to be amended or actions reviewed. The board 
agreed the RAID log accurately reflected the risks, actions, issues 
and decisions across the programme and that no adjustments were 
needed. 


The board discussed the risk that the extra hours currently being 
worked by staff becomes the “norm”. Paul Arnold confirmed that 
staff working significant additional hours would not be sustainable if 
it did become the norm and that Department Heads needed to 
consider whether current arrangements were as a function of peaks 
in work associated with GDPR preparations or indicative of long 
term demand. If departments had reviewed their working practices 
and were satisfied that additional resources were needed for the 
future then proposals could be submitted. In the meantime staff 
working additional hours to address business needs should be 
recognised for their efforts and should definitely be paid overtime 
for the hours they are working. 


10. Any Other Business 
There was no any other business. 
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16 October 2017 

Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Steve wood Deputy Commissioner (Policy) 

James Dipple-Johnstone Deputy Commissioner (Operations) 
Jonathan Bamford Head of Parliament and Government Affairs 
Jo Pedder Head of Policy & Engagement 

Ken Macdonald Head of ICO Regions 

Mike Collins Head of Organisational Development 
Heather Dove Head of Finance 

Rob Parker Head of Corporate Communications 
Andrew Laing Head of Data Protection Complaints and Reviews 
Steve Eckersley Head of Enforcement 

Anulka Clarke Head of Assurance 

Rachael Cragg Group Manager Change Programme 

Sarah Meyers Change Programme Manager 

Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Richard Marbrow, Faye Spencer, 
Emma Deen and Louise Byers. 


2. Matters arising from the previous meeting 
Minutes 
The minutes from the previous meeting were agreed. 


Action Board 
The actions were updated and cleared where possible. 


3. Monthly Report Review 
Service Delivery 
e Rachael Cragg confirmed that the PDB pilot is on track to go 
live as planned at the start of November. 
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The internal DPIA process was discussed and the impact this 
will have on resource requirements from the Policy 
Directorate. 


Policy & Engagement 


There were no major issues arising from the report. 


Steve Wood updated on the contact from DCMS regarding 
guidance and particularly the support being given to SMEs to 
prepare for GDPR. 


It was agreed that we need to put in place plans to advertise 
the work that is currently being done and make use of the 
helpline to highlight the help that is already in place. 


Jo Pedder confirmed that the guidance for SMEs will be loaded 
onto the gov.net website shortly. 


The possibility of conducting our own survey with regard to 
preparedness for GDPR is already being looked into by 
Jonathan Bamford, Jo Pedder and Rob Parker. 


Action 
Jo Pedder to put the DCMS guidance plan onto ICON. 


Enabler Project 


[Redacted] 


The new Contact Centre will be going live on Thursday 19 
October. 


The Applicant Tracking System will go live on 15 November 
2017. 


Mike Collins highlighted the staff turnover increase in the 
second quarter of the year. Updates on staff turnover will be 
reported back to the DCEO SG. 


Accommodation; work on the new accommodation should 
start shortly and the aim is to have Kings Court ready for use 
in Quarter 4. 


Jonathan Bamford queried the delay that is being experienced 
with regard to the clearance process and reference checks for 
new starters. Mike Collins was not aware of any particular 
problem in the process but will look into it. 
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e GDPR preparation; Mike Collins confirmed that the work on 
the ICO leaver files has now started. 


Action 
Mike Collins to check on the clearance process and report back to 
DCEO SG. 


4. BBFC Paper 
[Redacted] 


5. Transitional Provisions 
Discussion 
The Service Delivery team had been asked what transitional 
provisions were needed for the implementation of GDPR. The paper 
has been circulated to allow for comments. 


Actions 
Rachael Cragg to link up with Judith Jones and report back if there 
are any issues. 


6. Review of Staff Survey Results 
Discussion 
The analysis of the staff survey was discussed. 


Agreed 

It was agreed that the work of the Network reps should be re- 
emphasised along with the need to give regular updates to 
departments. 


Action 
Each department to engage with the GDPR Network reps. 


Communications 
Discussion 
Rob Parker updated on the communications grid which is working 
well. 


6. Raid Log 
Discussion 
James Dipple-Johnstone updated on the risk relating to transitional 
arrangements. 


Paul Arnold asked if there is a need for discussions to take place to 
identify work streams that can be postponed until after May 2018 to 
enable us to direct all our available resources to areas of greatest 
GDPR readiness priority. 
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James Dipple-Johnstone confirmed that some discussions have been 
taking place within Assurance. 


7. Any other business 
Discussion 
There was no other business 
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Deputy Chief Executive Officer Steering Group minutes 
17 August 2017 


Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Ken Macdonald Head of ICO Regions 

Emma Deen Head of Business Development and IT 
Heather Dove Head of Finance 

Andrew Laing Head of Data Protection Complaints and Reviews 
Steve Eckersley Head of Enforcement 

David Wells Head of IT Assurance 

Richard Marbrow Corporate Governance Group Manager 
Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Faye Spencer, Louise Byers, Robert 
Parker, Mike Collins and Jonathan Bamford. 


2. Matters arising from the previous meeting 


Minutes 
The minutes of the previous meeting were agreed with the 
amendment to Dave Wells’ job title as Head of IT Assurance. 


Action Board 
Updates were given on the action board 


3. Finance Report 


Discussion 
Heather Dove ran through the highlights from the Finance Report. 
e Income remains on track and costs remain within our 
accepted variance level. 
e The biggest expenditure will be staff recruitment. There is 
also some uncertainty in this area due to changing business 
needs leading to different resource strategies with differing 
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cost profiles being introduced in year. This is however being 
tracked closely. 

e Budget planning for 2018/19 will begin in September with a 
view to sign off with DCEO Steering Group and Senior 
Leadership Team in November. 

e Heather is meeting with DCMS in September to discuss how to 
treat the loan this year and the budget for next year. It was 
agreed that the details of this meeting do not need to be 
brought to the Steering Group for a decision. 


Richard Marbrow queried the permanent planned FTE figure for 
band H. 


Actions 
Heather Dove to double check the figure for band H 


Heather Dove asked whether the FOI Budget should come to the 
DCEO SG on a quarterly basis. 


Decision 
The group agreed that the FOI budget can be brought annually 
unless there is a specific risk to flag within the year. 


4. IT Strategy 


Discussion 
Emma Deen ran through the new dashboard report. The group 
agreed that the new dashboard format works very well. 

e Emma Deen explained that P1 refers to a total loss of systems 
and P2 refers to partial loss of systems. 

e By keeping the number of problems awaiting project/change 
under the SLA of 10 we are achieving the right balance 
between maintaining a stable environment, and introducing 
changes and new innovation. Changes to the live environment 
can inevitably lead to incidents where a problem record is 
generated. 

e The monitoring section refers to cyber security. The project 
hopes to take the monitoring to a higher level than we 
currently have. 


Steve Eckersley suggested that the Dashboard should be shared 
across the office. Emma agreed that the plan is to make it 
available on the Business Development and IT page on ICON. 


Actions 
Emma Deen to make the dashboards available on ICON 
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Discussion 
Email trust and leaving PSN 

e Progress is being made on the management of Official and 
Official Sensitive emails. 

e Reasonable feedback has been received from Heads of 
Departments on who Official Sensitive emails are being sent 
to. 

e The next steps will be to encourage staff to consider what 
they are sending and how it should be sent. 


Action 

Dave Wells (via Steve Rook) to take an urgent item to the next 
LIMO forum to ask what official sensitive information is sent by 
email, in what context (eg, casework, contract management etc) 
and approximately how many emails per day/week/month this 
represents. 


Steve Eckersley confirmed that he is putting together a position 
paper with regard to cyber security and staff security clearance. 
Dave Wells confirmed that Steven Rook is working with Mike Collins 
on the clearance process and a paper should be going to the Senior 
Leadership Team shortly. 


5. Terms of reference 
The amended Terms of Reference were agreed. 
6. Any other business 


Paul Arnold updated the group on the Senior Leadership Team 
meeting on Monday. 

e There was a proposal to bring OD function into line with the 
rest of the organisation and recruit Group Managers into that 
function. The proposal was approved by the Senior 
Leadership Team. 


Accommodation: - 

e A lease has been secured on new accommodation within Kings 
Court. A project team will be meeting within the next two 
weeks to look at the next steps and how to best utilise the 
space. The group thanks Mike Collins and his team for their 
excellent work in securing the new accommodation in such 
quick time and helping to mitigate a significant corporate risk. 
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7. Risk Register 


Decision 
It was agreed to reduce the accommodation risk to 1 
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Deputy Chief Executive Officer Steering Group minutes 
21 September 2017 


Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Jonathan Bamford Head of Parliament and Government Affairs 
Mike Collins Head of Organisational Development 
Emma Deen Head of Business Development & IT 

Faye Spencer Head of Customer Contact 

Heather Dove Head of Finance 

Rob Parker Head of Corporate Communications 
Andrew Laing Head of Data Protection Complaints and Reviews 
Louise Byers Head of Risk and Governance 

David Wells Head of IT Assurance 

Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Richard Marbrow, Ken Macdonald and 
Steve Eckersley 


2. Matters arising from the previous meeting 
Action Board 
Updates were given on the action board and all actions were 
cleared. 


3. Finance Report 
Discussion 
Heather Dove ran through the highlights from the Finance report. 
e We are now half way through the financial year with no 
material variances to cause concern 
e Budget planning for 2018/19 has now commenced with a view 
to sign off with DCEO SG and SLT in November. 
e Heather Dove flagged the savings currently showing on the 
salary costs in this month’s report. These savings have been 
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budgeted elsewhere within the organisation to cover new 
initiatives. 


The group discussed the workforce planning and wanted to check 
whether it was on track. 


Decision 
It was agreed to refresh the recruitment plan each quarter. 


Actions 
Mike Collins to bring a recruitment progress report to the next 
Steering Group meeting in October. 


4. IG Strategy 
Recruitment Checks Paper 
Discussion 
The group discussed the paper presented by Mike Collins regarding 
security checks for new staff. The three options outlined in the 
paper were considered. 


Decision 

The group were comfortable to align the ICO with wider government 
practices and agreed to implement option 3; to carry out mandatory 
security checks in line with the Baseline Personnel Security 
Standard (BPSS) as part of our recruitment check process after 
joining the ICO. This timing would be considered on a case by case 
basis according to the role being recruited. 


It was further agreed that the same standards should apply to 
temporary staff. 


It was agreed that any fees incurred by a candidate applying for the 
disclosure certificate will be reimbursed by the ICO. 


Actions 
Mike Collins to liaise with Heather Dove with regard to reimbursing 
the fee. 


Mike Collins to ensure that a Privacy and Security Impact 
Assessment is carried out. 


Paul Arnold to mention the issue with the Senior Leadership Team. 


Email Security 
[Redacted] 
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IT Assurance Quarter 2 Report 
Discussion 
[Redacted] 


5. Any other business 
Discussion 
The resilience paper circulated by Mike Collins was discussed. 


Paul Arnold stated that the work needed to better reflect resilience 
associated with preparing to recruit new staff as well as knowledge 
management. 


Decision 
It was agreed that is would be very useful to present the paper to 
the Senior Leadership Team. 


Actions 
Mike Collins to make the recommended amendments to the report 
and circulate. 


Discussion 
Paul Arnold informed the group that SLT Formal meetings will now 
be meeting once a month. 


Decision 
An ICON communication will be updating all staff in due course. 
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Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 
Jonathan Bamford Head of Parliament and Government Affairs 
Ken Macdonald Head of ICO Regions 

Mike Collins Head of Organisational Development 
Emma Deen Head of Business Development & IT 

Faye Spencer Head of Customer Contact 

Heather Dove Head of Finance 

Rob Parker Head of Corporate Communications 
Andrew Laing Head of Data Protection Complaints and Reviews 
Steve Eckersley Head of Enforcement 

Louise Byers Head of Risk and Governance 

David Wells Head of IT Assurance 

Richard Marbrow Corporate Governance Group Manager 
Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
There were no apologies 


2. Matters arising from the previous meeting 
Minutes 
The minutes from the previous meeting were agreed 


Action Board 
Actions were updated and cleared where possible 
e Mike Collins updated on the new security clearance process. 


3. Finance Report 
Discussion 
Heather Dove confirmed that income and expenditure were on 
track. The group noted risk and challenges arising from managing 
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the number of new initiatives over the next 6 months; eg, preparing 
Kings Court, IT Projects and recruitment. 


4. People Strategy 
Home Working Policy 
Discussion 
The group discussed the updated home working policy which allows 
more flexibility for Departments Heads to manage the needs of their 
department. 


Emma Deen highlighted that there is at least a four week lead time 
on new homeworking kit while the encryption software replacement 
project takes place. 


Decision 
It was agreed that the amended policy should be implemented. 


Staffing Report - Outsourcing 

Discussion 

The recruitment process was discussed; in particular the need to 
explore all avenues to fill vacancies efficiently, both for internal and 
external candidates. 


The group also discussed the possibility of outsourcing some 
strategic projects should we not have the resources to cover the 
work in-house. 


Decision 
It was agreed to further consider starting a procurement process to 
outsource certain projects. 


Actions 
Paul Arnold to seek the views of the Senior Leadership Team on 
outsourcing work. 


Each Department Head to look at how outsourcing could be utilised 
within their department 


Discussion 
The equal pay analysis was discussed. 


Decision 

It was confirmed that work was done routinely to make sure our 
recruitment and selection practices were fair and equitable with 
gender being one such area of focus. It was confirmed that 
providing equality of opportunity and ensuring the best candidate is 
appointed to each role we advertise was our approach and at this 
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time the Steering Group didn’t recommend any further courses of 

action. The Steering Group was however interested in the views of 
the SLT and MB who will be presented with the information at the 

next MB meeting. 


5. ISO27001 
Discussion 
This paper provides an update on the work of the project board and 
comes to the group for approval of the high level documentation 
required for certification. 


Decision 
There were no issues with the paper and it was agreed that the 
paper should go to Management Board in November. 


6. Any other business 
e Mike Collins highlighted that the European Data Protection 
Supervisor had sent through a request for Secondees. It was 
agreed to decline the request in line with our established 
policy in this area subject to confirming Steve Wood’s views 
given his responsibility for our International work and 
relationship with the EDPS. 


e Next year’s flexi calendars will have two systems; calendar A 
and calendar B to help manage flexi days across the 
organisation. This will be implemented in the New Year. 


e Paul Arnold stated that there is a need to start planning for 
2018/19 and identify new roles that we do not currently have 
within the business. 


e Jonathan Bamford highlighted the ongoing room booking 
problem and identified a need to reinforce the etiquette of 
booking rooms and releasing rooms if they are no longer 
needed. 


It was agreed that these points should be reinforced within 
each department. Emma Deen confirmed that IT can put a tip 
of the week on ICON on how to cancel a room booking. 
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7. Risk Register 
Discussion 
The risk relating to outsourcing projects was discussed. 


Decision 

It was agreed that pending discussions on this issue, this will need 
to be added to the risk register possibly as a mitigating action to 
the recruitment and retention risks. 
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7 September 2017 

Members 

Steve Wood Deputy Commissioner (Policy) (Chair) 
Jonathan Bamford Head of Parliament and Government Affairs 
Jo Pedder Head of Policy and Engagement 

Heather Dove Head of Finance 

Robert Parker Head of Corporate Communications 
Richard Marbrow Corporate Governance Group Manager 
Rachael Cragg Group Manager Change Programme 
Attendees 

Elizabeth Denham Information Commissioner 

Adam Stevens Acting Group Manager, Intelligence and Research 


(joining for Item 3) 


Secretariat 
Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Steve welcomed Elizabeth to her first Policy Steering Group meeting 


Apologies were received from Faye Spencer, Adam Sowerbutts, 
Anulka Clarke, Ken MacDonald and Peter Brown 


Action: 
Steve Wood to liaise with James Dipple-Johnstone about arranging 
substitutes for future meetings where necessary. 


2. Matters arising from the previous meeting 
Minutes 
There were no matters arising from the previous minutes and the 
minutes were agreed. 


Action Board 
e Completed actions were cleared. 
e It was agreed to put the action regarding developing a road 
map to help identify regulatory overlap on hold until a 
secondee was in place and available to consider the issue. The 
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action date was to be updated accordingly for clearance by 31 
October. 


3. Strategic Files 
Discussion 
Richard Marbrow presented a paper on the proposed strategic file 
and priority case procedure. Richard explained that the proposal 
would provide transparency for the Senior Leadership Team and 
allow cases to be prioritised effectively. 


Decision 

The proposal was agreed and will be taken to SLT for approval 
before being rolled out across the ICO organisation by the end of 
October. 


Actions 
Adam Stevens to amend existing templates to include investigations 
plans, decisions made and a de-brief when a case is closed 


Richard Marbrow and Adam Stevens to make minor amendments to 
the process based on the feedback received at the meeting and to 
bring the paper to the Senior Leadership Team on the 9 October. 


4. Review of Priority Policy Work streams 
British Board of Film Classification 
Discussion 
Jo Pedder presented a paper on the Digital Economy Act 2017 and 
the provisions requiring age verification for access to online porn. 
The ICO was liaising with the BBFC and to develop guidance in this 
area. 


It was recognised that there is a broader issue involving vulnerable 
people; when people want help to stop looking at porn. 


Decision 
It was agreed to recommend that the guidance includes vulnerable 
people and not just children. 


The group noted the risks highlighted in the paper and felt it was 
important that the issue is referred back to Change Board in the 
autumn. 


It was agreed that this item should remain on the policy work 
stream tracker. 
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Action 
Corporate Governance to put the item on the agenda for the next 
Change Board meeting, 16 October. 


CCTV 

Discussion 

The group discussed the interpretation of the DPA section 36 
domestic purposes exemption with regard to CCTV. The group also 
discussed the use of dashcams and handheld devices for personal 
use. 


Decision 

It was agreed that issues around the use of dashcams were 
different to those of standard CCTV and may need to be looked at 
separately. 


Handheld devices used for personal use were not considered. 


The group supported the recommendation in the report of adopting 
Option B. 


Actions 

Jo Pedder to organise a Tasking and Coordinating Group to discuss 
matters arising and to report back to the Steering Group at the next 
meeting on 5 October. 


Data Ethics 

Discussion 

Proposals for the ICO’s possible involvement in taking forward Data 
Ethics issues were presented for discussion. 


Decision 
The group supported the paper and its recommendations. 


5. Research Update 
Discussion 
There were no updates. 


6. Grants Programme update 
Discussion 
Lisa O’Brien provided a report outlining the number of applications 
received for the Grants Programme and the amounts requested. 


117 applications have been received from a wide variety of 
organisations and individuals. The panel will be meeting next week 
to consider all the applications. 
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It was noted that a replacement will be needed for Lisa O’Brien once 
she transfers over to the Commercial Legal Team. It was confirmed 
that this vacancy should be covered in the current recruitment 
process for Senior Policy Officers. 


Actions 

Lisa O’Brien to explore the possibility of referring strong grant 
applications that are not accepted to other funding bodies and to 
report back to the Steering Group by 5 October. 


7. Technology Update 
Discussion 
Peter Brown had provided a written brief update. A full update will 
be coming to the next Policy Steering Group. 


8. Consultation and Select Committee responses 
Discussion 
Steve Wood stated that the report indicates the breadth of activity 
currently taking place. 


g. Change Programme 
Communications Grid 
Discussion 
The aim of the grid is to present an overview of the change project 
and activities from a communications perspective as we count down 
to May 2018. 


Robert Parker highlighted that we have been approached by a 
company keen to be involved in a GDPR awareness campaign. 
Whilst this was an opportunity, there is a need to ensure that we 
have the right messages to send to data controllers and a coherent 
communications plan in place by the time this campaign was run. 


Actions 
Robert Parker to explore the possibility of being involved in the 
campaign and to report back to the Steering Group on [?]. 


SME Guidance 

Discussion 

Jonathan Bamford presented a paper on advice for SMEs which 
would encompass their duties under GDPR. This guidance would be 
made available on .gov.uk. 


Decision 
It was agreed that using .gov.uk would be helpful in getting our 
messages across, linked to from our own website. 
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Actions 

Jonathan Bamford to arrange a meeting with representatives from 
Parliamentary and Government Affairs, Policy & Engagement and 
Communications to discuss the material to be included in the 
guidance. 


10. Risk and Opportunity Register 
Discussion 
There were no new risks to be added to the register 


Jo Pedder flagged up that the risk rating on staff retention appeared 
to be low. 


Action 

Rachael Cragg to amend the Policy and Engagement RAID log in 
relation to pressure on the ICO to have comprehensive GDPR 
guidance available immediately. 


11. Any Other Business 
There was no other business. 
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Members 

Steve Wood 
Emma Bate 

Ken Macdonald 
Faye Spencer 
Heather Dove 
Robert Parker 
Adam Sowerbutts 


Anulka Clarke 
Richard Marbrow 
Rachael Cragg 


Attendees 
Iain Bourne 


Secretariat 
Caroline Robinson 


Deputy Commissioner (Policy) (Chair) 
General Legal Counsel 

Head of ICO Regions 

Head of Customer Contact 

Head of Finance 

Head of Corporate Communications 
Head of Freedom of Information Complaints and 
Appeals 

Head of Assurance 

Corporate Governance Group Manager 
Group Manager Change Programme 


Senior Policy Officer 


Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Jonathan Bamford, Peter Brown and 


Jo Pedder. 


Steve Wood welcomed Emma Bate to her first Policy Steering Group 


(PSG) meeting. 


2. Matters arising from the previous meeting 


Minutes 


The minutes of the previous meeting were agreed. 


Iain Bourne updated the group on the Data Ethics paper. The paper 
has been sent to DCMS and had been well received. 


Action 


Iain Bourne to provide a further written update on Data Ethics at 
the next PSG meeting. 
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Action Board 
The outstanding actions were updated and cleared where necessary. 


3. Risks and Opportunities Register 
Discussion 
The group noted that there was a heightened risk relating to the 
pressure on the Policy Directorate. This was due to work arising 
from the passage of the Data Protection bill through Parliament. 
Rachael Cragg confirmed that this has been reflected in the Policy & 
Engagement RAID Log 


Steve Wood highlighted the close working between the Parliament 
and Government Affairs Department and the Communications 
Department in developing the “12 steps to preparing for the Law 
Enforcement Directive”. 


Actions 
Steve Wood to discuss how best to mitigate this risk with Jonathan 
Bamford and Jo Pedder. 


Corporate Governance to move ownership of the risk relating to a 
significant legal judgement having an impact on ICO work from 
Steve Wood to Emma Bate. 


4. Priority Cases 
Fire Safety Report 
Discussion 
The project considering public access to fire safety reports was 
discussed. 


Decision 
It was agreed to concentrate on access to reports concerning 
residential buildings initially. 


Actions 

Corporate Governance to arrange a meeting between Ken 
Macdonald, Jo Pedder and Adam Sowerbutts to look at which teams 
are best place to contribute to the work and agree timescales. 


5. Management Board Report 
Discussion 
There were no specific items to flag up for the Management Board 
Report. 
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6. Grants Programme update 
Discussion 
Steve Wood updated the group on the progress of the grants 
programme. An internal panel had met to conduct an initial review 
of applications, followed by an external grants panel on Monday 2 
October. There are now four applications being forwarded to the 
Commissioner with a recommendation to fund the research. 


The group discussed the possibility of linking some of the applicants 
who were looking at similar research ideas. 


7. Technology Update 
Discussion 
Peter Brown prepared an update on the actions recently taken by 
Technology Policy Department. 


Steve Wood announced that a Head of Technology Policy has been 
appointed and will be in post towards the end of November. 


8. Communications 
Data Protection Practitioner’s Conference 2018 
Discussion 
The conference has been planned for 9 April 2018. Rob Parker 
highlighted the need to identify the content leads for the five aims 
of the Information Rights Strategic Plan. 


Decision 

The group was supportive of the concept of the five content leads. 
It was agreed to bring the item to the next Change Programme 
Board to identify the leads. 


A request for potential attendees to register an interest would be 
sent out in the October enewsletter. 


Actions 

Corporate Governance to add the item and paper to the agenda of 
the next Change Programme Board meeting on 16 October so that 
the Board could identify the five content leads and set up a project 
board for the conference. 


ICO 2017 Research Review 

Discussion 

Rob Parker ran through the proposals for benchmarking and 
tracking of personal data. 


Decision 
It was agreed that this review is a useful tool to have. 
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g. Change Programme 
Discussion 
Rachael Cragg updated the group on the activities of the various 
change programme project boards and on additions made to the 
RAID log. 


Decision 

It was agreed that the Policy & Engagement monthly update report 
should be brought to the PSG meeting prior to the Change 
Programme Board meeting. 


Steve Wood updated the group on the A29 meeting that he had 
attended earlier this week and the ICO papers that were adopted 
into guidance. 


Steve Wood highlighted the risk on cross board complaints / 
infringements. It was felt that next steps and plans need to be 
agreed. 


Actions 
Rachael Cragg to meet with Hannah McCausland and Chris Hogan to 
discuss European coordination and contact points. 


10. Consultation and Select Committee responses 
Discussion 
The group discussed the current list of consultations/calls for 
evidence. 


Rob Parker highlighted a need for a consistent and professional 
approach to the finished responses. There is a standard template 
that is currently being used but it was agreed that this may need to 
be reviewed. 


Actions 
Rob Parker to speak with Jonathan Bamford and Judith Jones about 
the style of the template. 


Ken Macdonald updated the group on his meeting with the Scottish 
Parliament yesterday. 


11. Any other business 
Court Judgements 
It was agreed that there should be a standard agenda item to cover 
court judgements now that Emma Bate has joined the PSG. 


Steve Wood provided an update on a recent court case around the 
issue of international transfers of data. 
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Action 

Emma Bate to prepare a paper for the next PSG meeting on the 
short, medium and long term implications of the Schrems 
judgement. 


GDPR Awareness Campaign 

Rob Parker updated the group on the proposal brought to the last 
meeting about a consortium wanting to run an awareness campaign 
on GDPR. A paper will be taken to SLT. 


Action 
Rob Parker to provide an update at the next PSG meeting. 
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Members 

James Dipple-Johnstone 
Jo Pedder 

Emma Deen 

Andrew Laing 


Adam Sowerbutts 
Steve Eckersley 


Hannah Smith 
Richard Marbrow 


Secretariat 
Peter Bloomfield 


Deputy Commissioner (Operations) 

Head of Policy and Engagement 

Head of Business Development & IT 

Head of Data Protection Complaints and 
Reviews 

Head of Freedom of Information Complaints 
and Appeals 

Head of Enforcement 

Lead Communications Officer (Digital) 
Corporate Governance Group Manager 


Senior Corporate Governance Manager 


1. Introductions and apologies 


There were apologies from Faye Spencer, Anulka Clarke and Robert 
Parker. Hannah Smith was welcomed in Robert Parker's place. 


2. Matters arising from the previous meeting 


Minutes 


The minutes were agreed for accuracy and publication. 


Outstanding action points were discussed and cleared where 


possible. 


It was noted that there had been discussion of the need for 
operational performance reports to come monthly to the Steering 
Group, and to accommodate this the dates of the Steering Group 
would need amending to the Friday of the first full week of the 


month. 
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Outstanding internal audit recommendations were also considered. 
Steve Eckersley noted that the action in respect of timescales for 
investigations (due to be completed by 30 September) was already 
completed. 


Actions and decisions 
Corporate Governance to change the Steering Group dates as 
discussed in time for the next meeting. 


Steve Eckersley to confirm to Peter Bloomfield that the 
outstanding internal audit recommendation had been 
cleared, by close Monday 4 September. 


3. Operations summary report 
Discussion 
Sift backlogs were discussed. It was noted that the backlog had 
been cleared this month and there were some duplicate cases. 


No other issues were identified. 


4. Verbal updates 


Enforcement 


The department was keeping pace on intake despite growth in 
cases received. 

Similarly work was up to date on civil monetary penalties. 

The department was considering the criteria for closing cases. 
The criteria were to be circulated to the Steering Group. 

There was an update on the draft Regulatory Action Policy (RAP). 
There was a need for final comments before the draft was passed 
to James Dipple-Johnstone for discussion with the Commissioner, 
and then to the Steering Group. Any possible impact from the 
Data Protection Bill also had to be considered. 


Steve Eckersley to circulate the case closure criteria to the 
Steering Group by close Friday 8 September. 


Steve Eckersley to pass the draft RAP to James Dipple- 
Johnstone prior to discussion with the Commissioner by 
close Friday 8 September. 


Data Protection Complaints and Reviews 


1,700 cases had been received and 1,650 cleared. Cases were 
being allocated from May. 

The department was expecting to be at full complement by the 
end of September. 
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e Andrew Laing advised that meeting rooms SMO3 and SM04 were 
now being used to accommodate staff. 

e GDPR training was raised as a potential issue, in particular the 
line between formal GDPR training, development of policy lines 
and advising staff of the policy lines as normal business. 


Operational Department Heads to complete training needs 
analysis for their departments by the next Operations 
Delivery Board and to put proposals to the Change 
Programme Board. 


FOI Complaints and Appeals 

The department had closed more cases than received. 

The age of unallocated cases was about three months. 

The department was close to meeting its KPIs. 

It was planned to take level Cs from the assessment centre 
which if successful would mean the department would be close to 
full complement by the end of September. 


5. High profile case tracker 


Discussion 

Richard Marbrow highlighted the changes in the process for 
managing high profile cases. A draft procedure was with Deputy 
Commissioners for comments. The aim was to have one set of 
priority cases. Regular reports to SLT would allow them to flag up 
concerns. 


6. Communications grid 
Discussion 
Hannah Smith presented the GDPR communications grid. It drew 
together all of the projects which Communications need to 
contribute to. 


Decision 
It was agreed that the grid should be reviewed quarterly. 


8. Risk and opportunities. 
The risk and opportunity register were considered. 
g. Any other business 
James Dipple-Johnstone was shortly to send out a note about 


escalation of issues to the Commissioner, and would be seeking 
nominations for research on Cyber. 
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Members 

James Dipple-Johnstone Deputy Commissioner (Operations) 

Jo Pedder Head of Policy and Engagement 

Faye Spencer Head of Customer Contact 

Andrew Laing Head of Data Protection Complaints and 
Reviews 

Adam Sowerbutts Head of Freedom of Information Complaints 
and Appeals 

Steve Eckersley Head of Enforcement 

Anulka Clarke Head of Assurance 

Robert Parker Head of Corporate Communications 

Richard Marbrow Corporate Governance Group Manager 

Secretariat 

Caroline Robinson Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Emma Deen 


2. Matters arising from the previous meeting 
Minutes 
The minutes from the previous meeting were agreed. 


Actions and decisions 
Outstanding actions points were discussed and cleared where 
possible. 


3. Operations Summary Report 
Discussion 
The new monthly summary report was reviewed. It was noted that 
there appeared to be a few discrepancies in the figures. 
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Actions: 

Operation Department Heads to verify the figures to ensure that the 
stats on the monthly report tally with expectations. Comments on 
the report to be fed back to James Dipple-Johnstone by 13 October. 


4. Business Plan Updates 
FOI Complaints and Appeals 


Currently running at a deficit on the year. However, it is 
anticipated to pull back 15% of cases in second half of the 
year. 

Recently lost two senior case officers and looking at replacing 
with a combination of Ds and Cs which will allow for more 
members of staff within the department. 

There is a risk of losing staff in the policy recruitment process. 


Action 
Adam Sowerbutts to look at mitigating the risk of losing staff by 
putting in plans to backfill any vacancies. 


Data Protection Complaints and Appeals 


Volume: The second half of year is expected to be more 
productive than the first half. 

Timeliness: Still awaiting for the figures 

Quality: Service reviews and complaints; the group discussed 
the possibility of conducting a customer satisfaction survey in 
second half of the year. Andy Laing confirmed that the target 
is to have cases closed within a three month period. 
Resources: Target for the department is 100 staff and it is 
currently running at 85. There are still vacancies to fill which 
is proving difficult. Andy Laing proposed a movement of staff 
which included increasing the number of level Ds within the 
department. This was agreed in principle by the group. 


Enforcement 


Draft three of the Regulatory Action Policy from will soon be 
ready to circulate to the group and SLT. 

The risk level of the KPI cases has been changed. It was 
agreed to clear high risk cases quickly. This does not include 
the priority cases within the organisation. 

Resources: Steve Eckersley ran through the vacancies 
currently within Enforcement. 

The feedback received from the recent assessment centre 
recruitment was very positive. 

NIS: A paper is being drafted. 

Ongoing cases: The priority cases can be a drain on 
resources. Richard Marbrow confirmed that a draft of the 
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priority case procedure will be available soon and will be 
looking at the resource allocation plan. 


Assurance 


Running to plan with regard to DPA audits and follow ups 
There are currently seven vacancies within the department at 
the moment. 

All audits that we have committed to undertake by the end of 
year will be fulfilled. 

All but two visits focussing on breach reporting in central 
government have now been completed. Once completed, an 
outcomes report will be produced. 

Starting work on the charity sector on the back of recent 
enforcement work 

SME workshops are planned in quarter three and will be 
focussing on Health. 

New GDPR toolkit is on track. 

PECR audits: On track for the ten planned for the year. 

Final DRIPA report will be ready go to Elizabeth Denham in 
October. 

BCRs: Currently have 40 live applications. A blog is being 
planned around BCRs. 

Recruitment; looking to recruit 11 lead auditors plus a Level E 
Legal Executive to help the BCR team. 

EIDAS has been added to the change programme backlog. 


5. Regulatory Action Policy 
Discussion 
The Regulatory Action Policy was discussed. Version 4 will be ready 
to circulate to Group members by 11 October. Any comments on 
the policy to be fed back to Steve Eckersley. 


Actions 


Steve Eckersley to send out version 4 of the Regulatory Action 
Policy by 11 October. 


6. Risk Register 
The risk and opportunity register was considered. 


8. Any other business 
Management Board Report: 


The new format for the management board report was 
discussed. 


Data Protection Complaints and Appeals LNA 


This was brought to the group for information and will be 
going to Change Programme Board. 


Operations Steering Group 6 October 


Richard Marbrow confirmed that the PDARF pipeline has slowed 
down and thanked the group. 
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Robert Parker Head of Corporate Communications (chair) 
Ken Macdonald Head of ICO Regions 

Steve Eckersley Head of Enforcement 

Anulka Clarke Head of Assurance 

Richard Marbrow Corporate Governance Group Manager 
Secretariat 

Mehreen Perwaiz Corporate Affairs 


1. Introductions and apologies 


There were apologies from Jonathan Bamford, Adam Sowerbutts, Jo 
Pedder and Peter Bloomfield. 


2. Benchmarking the Information Rights Strategic Plan 


Discussion 
Benchmarking will be part of the planning event on the 12 
September. 


Procurement of the annual track research is underway. 


More qualitative research has been requested on trust issues. This 
will be a desk based research project. The results will then input 
into decisions on the Citizens’ Reference Panel. 


4. Corporate communications grid for GDPR 


Discussion 

Robert Parker introduced the grid. It was not included in the Change 
Board papers but would be circulated shortly. It helps clarify and 
break down the audiences the ICO needs to reach, and hence 
identify any gaps in ICO communications work. 
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5. Data Protection Practitioners’ Conference 


Discussion 

The conference will be held on the 8/9 April 2018. In respect of 
support from staff this would have to be managed carefully due to 
the then imminent commencement of the GDPR. 


There was discussion about who the headline speaker might be, and 
what might be promoted at the conference. 


6. Speech writing 


Discussion 

It was confirmed that press office would meet with the 
Commissioner and relevant experts in the ICO two months before a 
speech was due to ensure timely preparation. 


7. Staff survey 


Discussion 
The staff survey would be run in October. It would include staff 
focus groups. 


There would be communications to staff on the survey and on what 
had happened after the last survey — on taking forward actions. 


8. International Conference of Information Commissioners 


Discussion 

It was confirmed that staff could attend this conference so long as 
there was a clearly identified development opportunity from doing 
so, and it was agreed by their line manager. 


g. Any other business 
Robert Parker confirmed that the Group Manager vacancy in Corporate 


Affairs had been filled. Another Group manager would be appointed to 
increase resilience. 


